Censys Platform FAQs

Does the Censys Platform use the same domain-specific language as Legacy Search?

No. The Censys Platform uses a new, easier-to-use language called Censys Query Language. You can learn more about CenQL here.

What is the advantage or use of web property assets?

Censys has historically scanned hosts with HTTP services running on them. There are several limitations with this approach:

It is difficult to extract information from multiple HTTP endpoints (such as /wp-admin and /login).
There is a high barrier to developing new HTTP-based scanners, like Cobalt Strike, Fortigate, ElasticSearch, Wordpress, etc.
Legacy Search users struggled with virtual hosts. It is unclear when they should search hosts versus virtual hosts.

Web properties address these concerns. Web properties:

Support data from multiple HTTP endpoints.
Reduce the complexity of developing and deploying HTTP-based scanners.
Make searching for web services feel like using a web browser.

Learn more about the differences between host and web property records.

How do web properties differ from host services?

Web properties offer insight into HTTP services beyond layer 7 while abstracting away HTTP protocol semantics.
Web properties are not tied to a specific IP. They use DNS to scan data residing on a name.
Web properties support deep scan information for HTTP-based scanners.

Learn more about the differences between host and web property records.

When should I search for web properties instead of a host service?

Search web properties when:

You want results that include hostnames.
You are targeting software that runs on top of HTTP, such as WordPress, pprof, Kubernetes, elastic search, and so on.
You are targeting software that services HTTP, like Apache or nginx.
You need HTTP body information.
You need data from endpoints other than /.

Do not use web properties when:

You want results that include IP addresses.
You are searching for DNS data, whois data, geolocation data, or routing data.
You are searching for hosts serving HTTP as well as non-HTTP protocols.

Learn more about the differences between host and web property records.

Where did HTTP body information on hosts move to in the Censys Platform dataset?

It moved to web.services.

Where are the labels from Legacy Search in the Censys Platform dataset?

In the Legacy Search dataset, labels are used for multiple purposes, ranging from indicating software manufacturers to describing records using descriptors like network.device or login-page.

There are fewer label values in Censys Platform than in Legacy Search. This is partially because labels in Legacy Search that were actually unstructured software, hardware, or operating system data have been moved to the appropriate component fields (e.g., jQuery, bootstrap) in the Platform.

The table below lists a few of the labels available in the Platform. Note that the values use screaming snake case .

Label name	Description
IPV6	Entity identified as a IPv6 host.
LOGIN_PAGE	Entity with an HTTP service that appears to host a login page.
OPEN_DIRECTORY	Web server with an exposed directory listing.

How can I perform relative time search in the Censys Platform?

Reference the documentation on using relative time in CenQL .

Does the Platform show the certificate chain for certificate records anywhere?

The certificate chain is shown in host.services.tls.presented\_chain.

Where can I find service.banner_hex information in the Censys Platform datasets?

It is present in host.services.banner_hex.